New staff regulations, adopted in January, legally bind the institutions to set up internal systems to ensure people who disclose fraud or other dubious behaviour are protected from blowback.

“I want to ensure that the EU institutions have in place the necessary rules to protect whistleblowers and to deal with complaints they submit about how they have been treated,” said O’Reilly.

Although both banks have whistleblower rules already in place, neither one is subject to the EU staff regulations.

The EU’s administrative auditor said it would not rule out launching a separate investigation into two banks at a later date.

Meanwhile, the nine EU institutions will have to report back to O’Reilly by the end of October.

The nine institutions probed are the European Parliament, the European Commission, the Council of the European Union, the Court of Justice of the European Union, the European Court of Auditors, the European External Action Service, the European Economic and Social Committee, the Committee of the Regions, and the European Data Protection Supervisor.

The Brussels-executive, for its part, has a had run-in with whistleblowers in the past.

Dutchman Paul van Buitenen was behind the 1999 revelations of corruption, cronyism, and abuse of power that saw all 20 commissioners under the then president Jacques Santer resign in disgrace. Van Buitenen quit the institution three years later because nothing had changed, he said.

In 2004, the commission fired its chief accountant Marta Andreasen after she said the EU's budget was being fiddled.

The commission then adopted new guidelines in December 2012 as part of its broader anti-fraud strategy but has yet to set up internal rules.

The guidelines explains the different channels for someone at the Commission “to blow the whistle” by bypassing the hierarchy, if necessary.

At the time, the Commission cited figures by the EU's anti-fraud office Olaf that it averaged around five cases per year.

A few months later in early 2013, its internal audit department set up an anonymous whistle-blower mailbox.

Brussels-based Transparency International (TI) in a report out in April found that most information received by the department “relates either to staff disputes within decentralised agencies, or journalists' enquiries for documents.”

It also noted that commission staff were the source of 165 of the 360 pieces of information received from the public sector by Olaf in 2012. It is unclear how many of those are whistleblower cases.

“They all have explicit obligations to have it but none of them really do except for the commission at the minute,” said Amanda McMenamin, a policy officer at TI.

The Council, for its part, says it has had internal whistleblower rules in place since 2006.

The article originally stated that the council has no internal whisteblower rules in place. This is incorrrect and the article was amended to reflect this on 31 July at 11:02.